Legacy Ansible Playbook Vulnerability in Verve Asset Manager by Rockwell Automation
CVE-2025-14377

8.8HIGH

Key Information:

Vendor

Rockwell Automation
Status
Verve Asset Manager
Vendor
CVE Published:
20 January 2026

What is CVE-2025-14377?

A security issue was identified in the legacy Ansible playbook component of Verve Asset Manager, which relates to the improper storage of plaintext secrets during playbook execution. This vulnerability arises from the fact that sensitive information is not encrypted, exposing it to potential unauthorized access. It's important to note that this component has been retired and was made optional since the 1.36 release in 2024. Users are advised to migrate away from this legacy feature to ensure better security practices.

Affected Version(s)

Verve Asset Manager 1.33 1.34 1.35 1.36 1.37 1.38 1.39 1.40 1.41 1.41.1 1.41.2 1.41.3

References

https://www.rockwellautomation.com/en-us/trust-center/sec...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.